xhg app http validates user